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ABSTRACT 

Access to private devices that are separated from the public network by firewalls and NATs is 
provided without reconfiguring the firewalls and NATs. A private device wishing to provide 
access to external devices establishes a virtual private pipe to a secure hub, which includes 
functionality to terminate virtual pipes and to switch communications between these pipes and 
the public network. The secure hub assigns a secondary IP address to the private device/pipe 
and thereby provides the private device with a network appearance that is now beyond the 
firewall/NAT. External devices access the private device by addressing communications to 
the secondary IP address, which communications are routed to the secure hub and tunneled 
through the pipe to the private device. The private device can also restrict access through an 
access control list that is enforced by the secure hub. 
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